So let's examine the packets and protocols with Wireshark, Wireshark is a free open source and is the
world's foremost network packet analyzer, and it's also the de facto standard across system and network
administrators wireshark as the ability to listen and record traffic, as well as contain some pretty
advanced filtering and reviewing options.
So first, I'm going to visit and HTP website and then an HTTP s Web site.
Let's go to Cali and run Wireshark.
You can open a terminal screen and type Wireshark to start it.
So these are the network interfaces that Wireshark is able to listen to.
You open another terminal screen and run the if config demand to see the network interfaces says, you
know, if config stands for network interface configuration.
So if we use the command without any parameter, it'll list all the interfaces available.
We have either zero as a network interface to listen to.
So now I'll turn back to Wireshark and double click e0 to selected.
Now Wireshark starts to listen to the Ethernet interface of Carly.
And to create some traffic, I'll open a Web browser and just visit an arbitrary Web site.
And now we have enough packets to examine, so I'll click the stop button at the upper left corner of
Wireshark to stop listening to the traffic.
So first we have some DNS packets to find out the IP address of the visited site.
Well, look at these kinds of packets soon.
But right now, let's just have a brief look.
So a DNS query for the IP version for.
Another DNS query for IP Version six, don't worry about the versions right now.
We'll cover them soon, I promise.
These DNS queries are transferred as UDP packets in transport layer.
The destination port is 53.
This is the IP packet with a source and the destination IP addresses.
So we'll go through the layers one by one, and we'll see all these packets, data, grams and frames
in detail, so we'll keep going.
This is the structure of the Ethernet frame.
First, there are two DNS queries for Dub, Dub, Dub, Hacker Academy, DOT UK.
One for the IPV for address and the other one is for the IPV six address because the website is redirected
to Hacker Academy DOT UK, there are two more DNS requests for this address.
Next, DNS packets are the DNS query responses.
This response is type A, that means it's an answer for the IPV for request.
And here is the answer, the IP address of the website.
Now, DNS response packet uses UDP at the transport layer, IP at the network layer, etc..
Here we have a TCP handshake between Collee and the Web server will also see this in detail later on.
A sin packett, a Sinak as a reply and an act packett to complete the handshake.
This is an http get request, we learned the IP address of the website and now the system is ready to
receive the Web page.
HTTP protocol and application layer.
Now you can see the headers and the parameters of the request.
TCP protocol and transport layer, Searsport destination, port flags, et cetera.
IP protocol in network layer.
Here are the source and destination addresses.
And Ethernet frame in layer two.
These are the TCP act, which will build the HTTP response.
So in this example, it's the Web page.
In other words, the response is transferred between the Web server and our system as fragmented packets
in transport layer.
Here's the response, two hundred, OK, so the webpage is received and here's a data, which is our
Web page.
These are the response, detailed response type headers, et cetera.
Here, there's additional information produced by Wireshark which says that the responses created by
reassembling five TCP segments or packets.
So now I'd like to show you the difference between that and HTP s traffic.
So I'll go to the browser and visit and https page now.
But before visiting the page, let's start Wireshark, here's a start button continue without saving.
OK, now we have a clean sheet.
So I'll go to the browser and hit enter.
Wow, lots of packets in milliseconds, so we've got plenty of packets to investigate.
Just click the stop button once again.
OK, so the DNS request and the response packets first, here is a response with an IP V4 address.
Here, there's a TCP three way handshake between Cali and Port four for three of Google's Web server.
And now a client hello tells Bacquet to start the TLS handshake again between Collee and Google server.
Now, to get rid of the other traffic records, I'd like to filter the results by the IP address of
the Google server.
Now, while the mouse pointer is on the server IP address, right, click and go to apply as filter
and select the selected option.
So as you can see here in the filter bar, the IP address is assigned as the destination IP address.
Now we only have to see the traffic where the destination is the Google server, but we'd like to see
both the incoming and the outgoing traffic.
So I'll change the DST part of the filter to ADR and click the Blue Arrow to activate the new filter.
Now we can see the traffic in both directions.
OK, so here we are at the hello text message.
Here are the details of the message TLC uses TCP protocol in transport layer, the Google server replies
a server hello message as a second step of the RTLS handshake.
Then comes the certificate and server key exchange and the server.
Hello, done message is sent by the server.
Cali sends the client to exchange Google server, sends a new session ticket.
And the encrypted communications starts.
Here is some encrypted application data, which is meaningless for others who listen to the traffic.
And as you can see here, the message is encrypted at the application layer, so you can still see the
source and the destination addresses the ports, et cetera.